import { asPosture, type PolicyVerdict, type Posture } from "../config/posture.js";
import type { McpServer } from "./servers.js";
/**
 * MCP governance — the SAME catalog, two policies. This is the other half of the
 * "benefits the community AND survives enterprise friction" story: per-server risk
 * is made legible in `.mcp.json` (the axes on {@link McpServer}); this module turns
 * those axes into a posture-aware verdict a reviewer can sign off on.
 *
 *  - `vibe` — permissive: nothing is blocked; third-party egress (and an
 *                      unpinned supply chain) is WARNED so a reviewer still eyeballs it.
 *  - `enterprise` — restrictive: third-party egress and unpinned supply chains are
 *                   DENIED (self-host or pin instead); a token-bearing server is
 *                   allowed but WARNED (source the secret from env, never commit it).
 *
 * Both branches read the risk axes (egress / credentials / supplyChain) plus the
 * explicit org-policy approval set. aih REPORTS the verdicts; it never silently
 * drops a server from the written config.
 */
export { asPosture };
export type McpPosture = Posture;
export type { PolicyVerdict };
/** One server's verdict under a posture, with a human reason for the doc / probe detail. */
export interface ServerPolicy {
    name: string;
    verdict: PolicyVerdict;
    reason: string;
}
export interface McpApproval {
    server: string;
    subject?: string;
    acceptEgress: true;
    reason: string;
    reviewer?: string;
    approvedAt?: string;
}
export interface McpPolicyOptions {
    allowedServers?: readonly string[];
    approvals?: readonly McpApproval[];
    disabledServers?: readonly string[];
}
export declare function mcpPolicyOptionsFromConfig(mcp: McpPolicyOptions | undefined, opts?: {
    includeEgressApprovals?: boolean;
}): McpPolicyOptions | undefined;
export declare function mcpApprovalSubject(server: McpServer): string;
/** Evaluate every server against a posture (stable order = the input map's order). */
export declare function evaluateMcpPolicy(servers: Record<string, McpServer>, posture: McpPosture, opts?: McpPolicyOptions): ServerPolicy[];
/** The denied subset — the "skipped-with-reason" list an enterprise rollout must resolve. */
export declare function deniedServers(policies: ServerPolicy[]): ServerPolicy[];
/**
 * The governance doc: the verdict table grouped by outcome, with the denied set
 * called out first (the skipped-with-reason list) plus how to remediate. Emitted as
 * a `doc` action under the enterprise posture — guidance only, no file is mutated.
 */
export declare function mcpGovernanceDoc(policies: ServerPolicy[], posture: McpPosture, opts?: {
    compliantApply?: boolean;
}): string;